Rules 19 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 19(9) gives the Data Protection Board of India six months to complete an inquiry, extendable by it, for reasons recorded in writing, for a further period not exceeding three months at a time. Rule 20 says the Board functions as a digital office and may adopt techno-legal measures so that proceedings need no physical presence.
Rules 19 and 20 are in the group that, under rule 1(2), comes into force on the date of their publication in the Official Gazette. An inquiry is to be completed within six months from the date of receipt of the intimation, complaint, reference or direction under section 27 of the Act, unless the Board extends it, for reasons recorded in writing, by not more than three months at a time. The Board functions as a digital office and may adopt techno-legal measures, without prejudice to its power to summon and examine on oath.
The rules and the Act
Section 27 of the Act sets out the Board's powers and functions, including inquiry on an intimation, complaint, reference or direction; section 28 deals with the inquiry procedure. See Section 27: powers and functions of the Board, Section 28: inquiry procedure and Section 28: civil court powers, interim orders and frivolous complaints. Section 23 of the Act, on proceedings and authentication, is in Sections 22 to 26. The rest of rule 19 is in our article on Board meetings and quorum.
Commencement: rule 1(2) puts rules 1, 2 and 17 to 21 in force "on the date of their publication in the Official Gazette". The Gazette is dated 13 November 2025. See rules 1 and 2. Remember that rules 3, 5 to 16, 22 and 23 start later, so the Board's procedure rules come ahead of many of the duties the Board will inquire into.
Anyone who may face an inquiry should understand its timetable, and dispute resolution support is a practical starting point.
Rule 19(9): six months, with extensions
"The inquiry by the Board shall be completed within a period of six months from the date of receipt of the intimation, complaint, reference or direction under section 27 of the Act, unless such period is extended by it, for reasons to be recorded in writing, for a further period not exceeding three months at a time."
| Element | Text |
|---|---|
| Time limit | "within a period of six months" |
| Starts | "from the date of receipt of the intimation, complaint, reference or direction under section 27 of the Act" |
| Extension | "unless such period is extended by it" |
| Conditions of extension | "for reasons to be recorded in writing" |
| Length of each extension | "a further period not exceeding three months at a time" |
What follows from the text
- The clock starts on receipt, not on the first hearing. The four triggers are an intimation, a complaint, a reference or a direction, all "under section 27 of the Act".
- The Board extends by itself. The text says "extended by it"; no party need consent, and the Rules do not give a party a right to ask.
- Reasons in writing are required for every extension.
- Each extension is capped at three months "at a time". The words "at a time" mean it can be done again: the Rule sets no overall limit on the number of extensions. Whether there is a limit elsewhere is not stated in the Rules, so none should be assumed.
- The Rule does not say what happens if the period lapses with no extension. The text is silent on a consequence.
Example (invented): a complaint against AppWorld, an invented gaming platform, is received by the Board on 1 March. The inquiry should be completed within six months, that is by 1 September. If the Board needs more time, it records reasons in writing and extends by up to three months, to 1 December at the most. If that is not enough, the words "at a time" let it extend again with fresh reasons. The example is ours; the Rules contain no Illustration for rule 19(9).
For the Act's own limits on how a complaint is dealt with, see the section 28 articles above; this article does not repeat them.
Rule 20: the Board as a digital office
"The Board shall function as a digital office, without prejudice to its power to summon and enforce the attendance of any person and examine her on oath, may adopt techno-legal measures to conduct proceedings in a manner that does not require physical presence of any individual."
Drafting slip: the sentence runs on. The words "without prejudice to its power ... examine her on oath" sit in the middle of "shall function as a digital office ... may adopt techno-legal measures". Read plainly, it says three things: the Board functions as a digital office; it keeps its power to summon and enforce attendance and to examine on oath; and it may adopt techno-legal measures to conduct proceedings without any individual having to be physically present. It is quoted as printed.
Techno-legal measures
Rule 2(1)(b) defines "techno-legal measures" only as "as referred to under rules 20 and 22". Rule 20 uses the term without defining it, so the Rules give no meaning of their own. This article therefore does not say what such measures are; see rules 1 and 2 for the definition slip. What rule 20 does say is the purpose: "to conduct proceedings in a manner that does not require physical presence of any individual".
The retained power
Digital working does not take away the power "to summon and enforce the attendance of any person and examine her on oath". The power is kept. Whether attendance in a given case is physical or remote is not settled by rule 20; the text says only that the Board "may adopt" measures that do not require physical presence.
Rule 22 gives the same digital-office treatment to the Appellate Tribunal; see rule 22.
What these rules do not say
They state no penalty. They do not describe the Board's online portal or any platform; anything the Board publishes on that is not in the Rules. They do not say how a complaint is lodged. Later amendments and notifications should be checked.
Need help preparing for a Board inquiry?
A six-month clock is short for gathering logs, contracts and consent records. Talk to our dispute resolution team about getting records in order before a complaint arrives.
Key takeaways
- Rules 19 and 20 come into force on publication in the Official Gazette (rule 1(2)).
- An inquiry is to be completed within six months of receipt of the intimation, complaint, reference or direction under section 27.
- The Board may extend by reasons recorded in writing for a further period not exceeding three months at a time.
- The Rules do not say what follows if the time lapses.
- The Board functions as a digital office and may adopt techno-legal measures, which the Rules do not define.
- Later amendments and notifications should be checked.
Read next
- Rule 19(1) to (8): meetings of the Board, quorum and authentication
- Rule 22: appeal to the Appellate Tribunal
- Section 28 of the DPDP Act: inquiry procedure of the Board
- Rules 1 and 2: definitions and staged commencement
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.